How to handle sub-search with no results and error in search command: "Unable to parse the search"?

[amerineni]

Why am I not getting results from this search?
Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side

| search c_ip=[search  | stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return $c_ip ]

Thanks

[PavelP · Accepted solution]

Hello @amerineni

please try with | return c_ip ] , without $

| search [stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return c_ip ]

[amerineni]

I need to return some dummy data if my sub search returns no results, otherwise my main search is returning all results. I achieved by doing this. is there any better way to do this?

Anyway thanks for the response.

|
eval sub_uuid=[ search index=cloudfoundry cf_org_name=Magenta_Pay cf_app_name=PaymentRestApi-* "Result based on transactionID" $identifier$
| rex "(?ms)uuid=(?[^]]+)" | eval uuid=uuid
| return $uuid | format] |eval test=if(isNotNull(sub_uuid), sub_uuid, "XXXXX") | where uuid=sub_uuid | table URI, HttpStatus, ElapsedTime, _time